Artificial intelligence cyber security analyst

ABSTRACT

An analyzer module forms a hypothesis on what are a possible set of cyber threats that could include the identified abnormal behavior and/or suspicious activity with AI models trained with machine learning on possible cyber threats. The Analyzer analyzes a collection of system data, including metric data, to support or refute each of the possible cyber threat hypotheses that could include the identified abnormal behavior and/or suspicious activity data with the AI models. A formatting and ranking module outputs supported possible cyber threat hypotheses into a formalized report that is presented in 1) printable report, 2) presented digitally on a user interface, or 3) both.

RELATED APPLICATION

This application claims priority to and the benefit of under 35 USC 119of U.S. provisional patent application titled “A cyber threat defensesystem with various improvements,” filed Feb. 20, 2018, Ser. No.62/632,623, which is incorporated herein by reference in its entirety.

NOTICE OF COPYRIGHT

A portion of this disclosure contains material that is subject tocopyright protection. The copyright owner has no objection to thefacsimile reproduction by anyone of the material subject to copyrightprotection as it appears in the United States Patent & TrademarkOffice's patent file or records, but otherwise reserves all copyrightrights whatsoever.

FIELD

Embodiments of the design provided herein generally relate to a cyberthreat defense system. In an embodiment, Artificial Intelligence (AI) isapplied to analyzing cyber security threats, where the AI does both theanalysis and data gathering to assess cyber threats to the system.

BACKGROUND

In the cyber security environment, firewalls, endpoint security methodsand other tools such as SIEMs and sandboxes are deployed to enforcespecific policies, and provide protection against certain threats. Thesetools currently form an important part of an organization's cyberdefense strategy, but they are insufficient in the new age of cyberthreat. Legacy tools are failing to deal with new cyber threats becausethe traditional approach relies on being able to pre-define the cyberthreat in advance, by writing rules or producing signatures. In today'senvironment, this approach to defend against cyber threats isfundamentally flawed:

-   -   Threats are constantly evolving—novel attacks do not match        historical-attack “signatures”, and even subtle changes to        previously understood attacks can result in them going        undetected by legacy defenses;    -   Rules and policies defined by organizations are continually        insufficient—security teams simply can't imagine every possible        thing that may go wrong in future; and    -   Employee ‘insider’ threat is a growing trend—it is difficult to        spot malicious employees behaving inappropriately as they are a        legitimate presence on the business network.

The reality is that modern threats bypass the traditional legacy defensetools on a daily basis. These tools need a new tool based on a newapproach that can complement them and mitigate their deficiencies atscale across the entirety of digital organizations. In the complexmodern world, it is advantageous that the approach is fully automated asit is virtually impossible for humans to sift through the vast amount ofsecurity information gathered each minute within a digital business.

Over a given week in a large organization, thousands of incidents ofabnormal behavior can be logged and need to be reported to a human cybersecurity analyst. To aid the human cyber security analyst, various blankdynamically human-supplied and/or machine created templates can beutilized.

SUMMARY

In an embodiment, an AI cyber security analyst protects a system,including but not limited to a network, from cyber threats. A triggermodule may identify, with one or more AI models trained with machinelearning on a normal behavior of the system, at least one of i) anabnormal behavior, ii) a suspicious activity, and iii) any combinationof both, from one or more entities in the system. The analyzer modulemay form one or more hypotheses on what are a possible set of cyberthreats that could include the identified abnormal behavior and/orsuspicious activity from the trigger module with one or more AI modelstrained with machine learning on possible cyber threats. The analyzermodule may analyze a collection of system data, including metrics data,to support or refute each of the one or more possible cyber threathypotheses that could include the identified abnormal behavior and/orsuspicious activity data with the one or more AI models trained withmachine learning on possible cyber threats, where the analyzer modulegenerates one or more supported possible cyber threat hypotheses fromthe possible set of cyber threat hypothesis with a score indicating theseverity of each hypothesis. The formatting module may format an outputof one or more supported possible cyber threat hypotheses from theanalyzer module into a formalized report, from a first template, such asa dynamic human-supplied and/or machine created template, that isoutputted for a human user's consumption in a medium of any of 1)printable report, 2) presented digitally on a user interface, or 3)both.

These and other features of the design provided herein can be betterunderstood with reference to the drawings, description, and claims, allof which form the disclosure of this patent application.

DRAWINGS

The drawings refer to some embodiments of the design provided herein inwhich:

FIGS. 1A and 1B illustrate block diagrams of an embodiment of the AIcyber-security analyst to protect a system, including but not limited toa network, from cyber threats.

FIG. 2 illustrates a block diagram of an embodiment of the AIcyber-security analyst trained on threat intel gathered from a varietyof sources including human cyber analysts, and synthesized and externalthreat data to assess, classify, report upon a cyber threat, andpossibly recommend actions or take actions autonomously in response tothis threat.

FIG. 3 illustrates a block diagram of an embodiment of the AIcyber-security analyst plugging in as an appliance platform to protect asystem.

FIGS. 4A and 4B illustrate a block diagram of an embodiment of the AIcyber-security analyst protecting a system.

FIG. 5 illustrates an example cyber threat defense system using an AIcyber-security analyst to protect an example network.

While the design is subject to various modifications, equivalents, andalternative forms, specific embodiments thereof have been shown by wayof example in the drawings and will now be described in detail. Itshould be understood that the design is not limited to the particularembodiments disclosed, but—on the contrary—the intention is to cover allmodifications, equivalents, and alternative forms using the specificembodiments.

DESCRIPTION

In the following description, numerous specific details are set forth,such as examples of specific data signals, named components, number ofservers in a system, etc., in order to provide a thorough understandingof the present design. It will be apparent, however, to one of ordinaryskill in the art that the present design can be practiced without thesespecific details. In other instances, well known components or methodshave not been described in detail but rather in a block diagram in orderto avoid unnecessarily obscuring the present design. Further, specificnumeric references such as a first server, can be made. However, thespecific numeric reference should not be interpreted as a literalsequential order but rather interpreted that the first server isdifferent than a second server. Thus, the specific details set forth aremerely exemplary. Also, the features implemented in one embodiment maybe implemented in another embodiment where logically possible. Thespecific details can be varied from and still be contemplated to bewithin the spirit and scope of the present design. The term coupled isdefined as meaning connected either directly to the component orindirectly to the component through another component.

In general, the AI Cyber Security Analyst sees something abnormal orsuspicious, then the AI Cyber Security analyst forms one or morehypotheses on what are the possibilities to cause this abnormal behavioror suspicious activity, then the AI Cyber Security analyst findsevidence/collects data to support or refute each possible hypothesis,assigns a threat level and an optional probability, and then generates aformal report.

With the real time speed of attacks and almost overwhelming volume ofdata within a system, this task of examining suspicious activitiesand/or abnormal behavior is very difficult for a human analyst to keepup with or perform; and thus, early detection of cyber threats may notoccur until after the cyber threat has already caused significant harm.

FIGS. 1A and 1B illustrate block diagrams of an embodiment of the AIcyber-security analyst to protect a system, including but not limited toa network, from cyber threats.

The AI cyber-security analyst 100 may include a trigger module, agatherer module, an analyzer module, an assessment module, and anoptional formatting module.

The trigger module may identify, with one or more AI models trained withmachine learning on a normal behavior of the system, at least one of i)an abnormal behavior, ii) a suspicious activity, and iii) anycombination of both, from one or more entities in the system.

The gatherer module may initiate a collection of data to support orrefute each of the one or more possible cyber threat hypotheses thatcould include this abnormal behavior or suspicious activity by the oneor more AI models trained on possible cyber threats.

The gatherer module may further extract data at the request of theanalyzer module on each possible hypothetical threat that would includethe abnormal behavior or suspicious activity and then filtering thatcollection of data down to relevant points of data to either 1) supportor 2) refute each particular hypothesis of what the cyber threat, thesuspicious activity and/or abnormal behavior relates to. The gatherermodule may send the filtered down relevant points of data to either 1)support or 2) refute each particular hypothesis to the analyzer module,comprised of one or more algorithms used by the AI models trained withmachine learning on possible cyber threats to make a determination on aprobable likelihood of whether that particular hypothesis is supportedor refuted.

The analyzer module configured to form one or more hypotheses on whatare a possible set of activities including cyber threats that couldinclude the identified abnormal behavior and/or suspicious activity fromthe trigger module with one or more AI models trained with machinelearning on possible cyber threats. The analyzer module may requestfurther data from the gatherer module to perform this analysis.

The analyzer module may further analyze a collection of system data,including metrics data, to support or refute each of the one or morepossible cyber threat hypotheses that could include the identifiedabnormal behavior and/or suspicious activity data with the one or moreAI models trained with machine learning on possible cyber threats, wherethe analyzer module generates one or more supported possible cyberthreat hypotheses from the possible set of cyber threat hypotheses.

The assessment module may assign a probability, or confidence level, ofa given cyber threat hypothesis that is supported and a threat levelposed by that cyber threat hypothesis, which includes this abnormalbehavior or suspicious activity, with the one or more AI models trainedon possible cyber threats.

The formatting module may format, present a rank for, and output one ormore supported possible cyber threat hypotheses from the analyzer moduleinto a formalized report, from a first template, such as a dynamichuman-supplied and/or machine created template, that can be outputtedfor a human user's consumption in a medium of any of 1) printablereport, 2) presented digitally on a user interface, or 3) both, or in amachine readable format for further reinforcement machine learning.

The trigger module, analyzer module and formatting module cooperate toimprove the analysis and formalized report generation with lessrepetition to consume CPU cycles more efficiently and effectively thanhumans repetitively going through these steps and re-duplicating stepsto filter and rank the one or more supported possible cyber threathypotheses from the possible set of cyber threat hypotheses.

The system may use at least three separate machine learning models. Eachmachine learning model may be trained on specific aspects of the normalpattern of life for the system such as devices, users, network trafficflow, outputs from one or more cyber security analysis tools analyzingthe system, etc. One or more machine learning models may also be trainedon characteristics and aspects of all manner of types of cyber threats.

FIG. 2 illustrates a block diagram of an embodiment of the AIcyber-security analyst trained on threat intel gathered from a varietyof sources including human cyber analysts, and synthesized and externalthreat data to assess, classify, report upon a cyber threat, andpossibly recommend actions or take actions autonomously in response tothis threat. Thus, the AI cyber-security analyst 100 automates theanalysis and reporting of cybersecurity breaches to improveinvestigation efficiency and guide human users. The AI cyber-securityanalyst 100 functionality, as an assistant, increases the efficiency ofa human cybersecurity analyst. The AI cyber-security analyst 100provides an automatic triage and write up tool based upon learnedbehaviors, derived from the data input sources above, providing keyinvestigation information to human operators.

The AI cyber-security analyst 100 can act as a mentor or coach to lessexperienced analysts who may be facing a similar cyber threat for thefirst time. The AI cyber-security analyst 100 does the initial analysisand then presents this analysis so that an investigation of potentialcyber security threats can be performed quicker/with less repetition,and a Security Operations Center teams can be leaner and focus oninteresting threats as a result. Moreover, AI cyber-security analyst 100has a more reliable ability, than a human, to analyze all of the dataand all of the possibilities to identify cyber threats, even apreviously unknown or subtle threat, to speed up the all-round responsetimes.

A trigger module may detect timestamped data indicating an event isoccurring and then triggers that something unusual is happening. Thegatherer module is triggered by specific events or alerts of i) anabnormal behavior, ii) a suspicious activity, and iii) any combinationof both. The inline data may be gathered on the deployment when thetraffic is observed. The scope and wide variation of data available inthis location results in good quality data for analysis. The receiveddata is passed to the cyber security analyst, which may be hosted on adevice, on one or more servers, and/or in its own cyber threat applianceplatform. (e.g. see FIG. 3)

The gatherer module may consist of multiple automatic data gatherersthat each look at different aspects of the data depending on theparticular hypothesis formed for the analyzed event. The data relevantto each type of possible hypothesis will be automatically pulled fromadditional external and internal sources. Some data is pulled orretrieved by the gatherer module for each possible hypothesis. Afeedback loop of cooperation between the gatherer module and theanalyzer module may be used to apply one or more models trained ondifferent aspects of this process. Each hypothesis of typical threats,human user insider attack/inappropriate network behavior, malicioussoftware/malware attack/inappropriate network behavior, can have varioussupporting points of data and other metrics associated with thatpossible threat, and a machine learning algorithm will look at therelevant points of data to support or refute that particular hypothesisof what the suspicious activity and/or abnormal behavior related foreach hypothesis on what the suspicious activity and/or abnormal behaviorrelates to. Networks have a wealth of data and metrics that can becollected and then the mass of data is filtered/condensed down into theimportant features/salient features of data by the gatherers.

The analyzer module uses one or more AI models trained through complexmachine-learning techniques on a behavior and input of how a pluralityof human cyber security analysts make a decision and analyze a risklevel regarding and a probability of a potential cyber threat. The AImodel learns how expert humans tackle investigations into specific realand synthesized cyber threats.

The gatherer module may use a set of scripts to extract data on eachpossible hypothetical threat to supply to the analyzer module. Thegatherer module may use a plurality of scripts to walk through a step bystep process of what to collect to filter down to the relevant datapoints (from the potentially millions of data points occurring in thenetwork) to make a decision what is required by the analyzer module toanalyze possible cyber threats with one or more AI models trained withmachine learning on a process of human analyzing on possible cyberthreats and the relevant data points human analysts examine to supportor rebut their analysis of a given cyber threat hypothesis.

The gatherer module may gather data associated with a window of time inwhich the abnormal behavior or a suspicious activity occurs and whenmultiple occurrences occur, and then filter that data for eachoccurrence instance to assess cyber threats to the system.

The analyzer module may get threat information from Open Source APIs aswell as from databases as well as information trained into AI models.

The analyzer module learns how expert humans tackle investigations intospecific cyber threats. The analyzer module may use i) one or more AImodels and/or ii) rules based models and iii) combinations of both thatare deployed onto one or more servers or can be hosted within a separateplug-in appliance connecting to the network.

The AI models use data sources such as simulations, database records,and actual monitoring of different human exemplar cases as input totrain the AI model on how to make a decision. The analyzer module alsomay utilize repetitive feedback, as time goes on, for the AI modelstrained with machine learning on possible cyber threats via reviewing asubsequent resulting analysis of the supported possible cyber threathypothesis and supply that information to the training of the AI modelstrained with machine learning on possible cyber threats in order toreinforce the model's finding as correct or inaccurate.

The analyzer module looks at different aspects of the data from multiplesources depending on the hypothesis formed for the analyzed event. Somedata is pulled or retrieved by the gatherer module for each possiblehypothesis. Each hypothesis has various supporting points of data andother metrics associated with that possible threat, and a machinelearning algorithm will look at the relevant points of data to supportor refute that particular hypothesis of what the suspicious activityand/or abnormal behavior relates to.

The analyzer module may perform analysis of internal and external dataincluding readout from machine learning models, which output alikelihood of the suspicious activity and/or abnormal behavior relatedfor each hypothesis on what the suspicious activity and/or abnormalbehavior relates to with other supporting data to support or refute thathypothesis.

In an example, a behavioral pattern analysis of what are the unusualbehaviors of the network/system/device/user under analysis by themachine learning models may be as follows. The a cyber defense systemuses unusual behavior deviating from the normal behavior and then buildsa chain of unusual behavior and the causal links between the chain ofunusual behavior to detect cyber threats. The unusual pattern isdetermined by filtering out what activities/events/alerts that fallwithin the window of what is the normal pattern of life for thatnetwork/system/device/user under analysis, and then the pattern of thebehavior of the activities/events/alerts that are left, after thefiltering, can be analyzed to determine whether that pattern isindicative of a behavior of a malicious actor—human, program, or otherthreat. The cyber defense system can go back and pull in some of thefiltered out normal activities to help support or refute a possiblehypothesis of whether that pattern is indicative of a behavior of amalicious actor. If the pattern of behaviors under analysis is believedto be indicative of a malicious actor, then a score of how confident isthe system in this assessment of identifying whether the unusual patternwas caused by a malicious actor is created. Next, also assigned is athreat level score or probability indicative of what level of threatdoes this malicious actor pose. Lastly, the cyber defense system isconfigurable in a user interface by each different user, enabling whattype of automatic response actions, if any, the cyber defense system maytake when for different types of cyber threats that are equal to orabove a configurable level of threat posed by this malicious actorindicated by the pattern of behaviors under analysis.

The analyzer module may rank supported candidate cyber threat hypothesesby combination of a likelihood that this candidate cyber threathypothesis is supported as well as severity threat level of thisincident type. These factors are combined to create a total orderingpossible cyber threat hypotheses presented in the formalized report onthe user interface, where a filtering out of refuted cyber threathypotheses and putting higher supported and more severe threat levelpossible cyber threat hypotheses higher in the total ordering ofpossible cyber threat hypotheses allows cyber personnel to better focuson interesting cyber threats that could include the identified abnormalbehavior and/or suspicious activity data.

The analyzer module may rank threat hypothesis candidates by analyzingdata (for an appropriate trigger) collected by the gatherer module.During analysis, the analyzer instance may carry out various forms ofdata processing and initiate further requests for data using thegatherer module. Upon analysis completion, each analyzer instance ranksincidents by a severity level of that threat and an optional hypothesisconfidence level. The analyzer instances can be, but are not limited to,a combination of supervised machine learning classifiers trained onlabelled data, unsupervised machine learning/anomaly detection, orhard-coded logic.

The analyzer module may group potential threat hypothesis candidatesthat have common unusual events and/or alerts including suspiciousactivity and/or abnormal behavior. The analyzer module may map groupsand their individual members of potential threat hypothesis candidatesto incident types. The grouping of potential threats may be performed byfour paradigms as appropriate for the threat and/or device type:

-   -   a. Unique incident    -   b. Repeating incident for device    -   c. Network wide incidents for the specific hypothesis.    -   d. Incidents occurring on same device around the same time.

Various incident types can have range of risk and threat severityassociated with that malicious threat.

The analyzer module may analyze various example factors:

-   -   Host information gathered inline;    -   DNS resolution including destination address or irregular source        address initiating that request;    -   Reverse DNS resolution;    -   Rarity;    -   Age of external endpoint;    -   Period/time of connection;    -   Unusualness of connection: first time connections, unusual port        used, unusual size of transfer, weird time of day for this event        to occur, unusual to see this type of data sent to this        particular outside domain or downloaded on this type of user's        machine,    -   Specific connections, DNS requests and notices in event logs        type of commands or communications occurring;    -   Host name is odd; and other similar factor

The analyzer module may be configured to use both

1) one or more supervised machine learning models trained on agnosticexamples of past history of detection of each possible type of cyberthreat hypothesis previously analyzed by human cyber threat analysis,and

2) one or more unsupervised machine learning models trained to performanomaly detection verses a normal pattern of life to determine whetherthe abnormal behavior and/or suspicious activity is malicious or benignwhen the cyber threat is previously unknown.

The supervised machine learning models use innovative, optimal MachineLearning techniques and quality sources of data to train them. The dataingested and derived from observation of human analysts. The supervisedmachine learning models use a wide scope and/or wide variation of data(with good quality data) to start the machine learning process toproduce strong enough learning to think the output will be valuable oruseful to an analyst user. The supervised machine learning models usedeep learning and reinforcement learning.

Once the AI cyber-security analyst 100 has decided an incident isreportable, the formatting module may generate a textual write up of anincident report in a human readable, formalized report format for a widerange of breaches of normal behavior, used by the AI models trained withmachine learning on the normal behavior of the system. This formalizedreport may be derived from human supplied textual content and/oranalyzing previous reports with one or more models trained with machinelearning on assessing and populating relevant data into the incidentreport corresponding to each possible cyber threat.

The formatting module may generate a threat incident report in theformalized report from a multitude of dynamic templates corresponding todifferent types of cyber threats, each template corresponding todifferent types of cyber threats that vary in format, style, andstandard fields in the multitude of templates. Each incident type mayhave a corresponding human supplied write-up frame or a dynamic write-upframe derived from machine learning models trained on existing incidentreports.

The formatting module may be further configured to populate a giventemplate with relevant data, graphs, or other information as appropriatein various specified fields, along with an optional ranking of alikelihood of whether that hypothesis cyber threat is supported and athreat severity level for each of the supported cyber threat hypotheses,and then output the formatted threat incident report with the ranking ofeach supported cyber threat hypothesis, which is presented digitally onthe user interface and/or printed as the printable report.

The formatting module may show relevant information to help the userdecide whether to include each incident. The formalized report may beoutput as a threat intelligence report document in a human readableformat. The formalized incident data can also be outputted in machinereadable format for further machine learning and reinforcement using theprocessed incident data.

The formatting module may complete the report, placing any relevantgraphs, details, and text into the threat intelligence report.

The formatting module generates fully automated summary reports that areautomatically produced on appliance for human verification and finalediting.

FIG. 3 illustrates a block diagram of an embodiment of the AIcyber-security analyst 100 plugging in as an appliance platform toprotect a system.

FIGS. 4A and 4B illustrate a block diagram of an embodiment of the AIcyber-security analyst protecting a system. The below steps need not beperformed in order where logically possible.

In step 400, the AI cyber-security analyst protects a system, includingbut not limited to a network, from a cyber threat.

In step 402, the AI cyber-security analyst identifies, with one or moreAI models trained with machine learning on a normal behavior of thesystem, at least one of i) an abnormal behavior, ii) a suspiciousactivity, and iii) any combination of both, from one or more entities inthe system.

In step 404, the AI cyber-security analyst forms one or more hypotheseson what are a possible set of activities including cyber threats thatcould include the identified abnormal behavior and/or suspiciousactivity with one or more AI models trained with machine learning onpossible cyber threats.

In step 406, the AI cyber-security analyst analyzes a collection ofsystem data, including metrics data, to support or refute each of theone or more possible cyber threat hypotheses that could include theidentified abnormal behavior and/or suspicious activity data with theone or more AI models trained with machine learning on possible cyberthreats.

In step 408, the AI cyber-security analyst formats, presents a rank for,and outputs one or more supported possible cyber threat hypotheses fromthe possible set of cyber threat hypothesis into a formalized report,from a first template, such as a dynamic human-supplied and/or machinecreated template, that is outputted for a human user's consumption in amedium of any of 1) printable report, 2) presented digitally on a userinterface, 3) in a machine readable format for further machine learningrefinement, or 4) any of these three.

In step 410, the AI cyber-security analyst generates a threat incidentreport in the formalized report from a multitude of templatescorresponding to different types of cyber threats, each template,including the dynamic human-supplied and/or machine created template(e.g. the first template), corresponds to different types of cyberthreats that vary in format, style, and standard fields in the multitudeof templates. The analyst also populates a given template with relevantdata, graphs, or other information as appropriate in various specifiedfields, along with a ranking of a likelihood of whether that hypothesiscyber threat is supported and its threat severity level for each of thesupported cyber threat hypotheses, and then output the formatted threatincident report with the ranking of each supported cyber threathypothesis, which is presented digitally on the user interface and/orprinted as the printable report.

In step 412, the AI cyber-security analyst has the trigger module,analyzer module and formatting module cooperate to improve the analysisand formalized report generation with less repetition to consume CPUcycles with greater efficiency than humans repetitively going throughthese steps and re duplicating steps to filter and rank the one or moresupported possible cyber threat hypotheses from the possible set ofcyber threat hypothesis.

FIG. 5 illustrates an example cyber threat defense system using an AIcyber-security analyst to protect an example network. The examplenetwork FIG. 5 illustrates a network of computer systems 50 using athreat detection system. The system depicted by FIG. 5 is a simplifiedillustration, which is provided for ease of explanation of theinvention. The system 50 comprises a first computer system 10 within abuilding, which uses the threat detection system to detect and therebyattempt to prevent threats to computing devices within its bounds. Thefirst computer system 10 comprises three computers 1, 2, 3, a localserver 4, and a multifunctional device 5 that provides printing,scanning and facsimile functionalities to each of the computers 1, 2, 3.All of the devices within the first computer system 10 arecommunicatively coupled via a Local Area Network 6. Consequently, all ofthe computers 1, 2, 3 are able to access the local server 4 via the LAN6 and use the functionalities of the MFD 5 via the LAN 6.

The LAN 6 of the first computer system 10 is connected to the Internet20, which in turn provides computers 1, 2, 3 with access to a multitudeof other computing devices including server 30 and second computersystem 40. Second computer system 40 also includes two computers 41, 42,connected by a second LAN 43.

In this exemplary embodiment of the invention, computer 1 on the firstcomputer system 10 has the threat detection system and therefore runsthe threat detection method for detecting threats to the first computersystem. As such, it comprises a processor arranged to run the steps ofthe process described herein, memory required to store informationrelated to the running of the process, as well as a network interfacefor collecting the required information. This method shall now bedescribed in detail with reference to FIG. 5.

The computer 1 builds and maintains a dynamic, ever-changing model ofthe ‘normal behavior’ of each user and machine within the system 10. Theapproach is based on Bayesian mathematics, and monitors allinteractions, events and communications within the system 10—whichcomputer is talking to which, files that have been created, networksthat are being accessed.

For example, computer 2 is based in a company's San Francisco office andoperated by a marketing employee who regularly accesses the marketingnetwork, usually communicates with machines in the company's U.K. officein second computer system 40 between 9.30 AM and midday, and is activefrom about 8:30 AM until 6 PM. The same employee virtually neveraccesses the employee time sheets, very rarely connects to the company'sAtlanta network and has no dealings in South-East Asia. The threatdetection system takes all the information that is available relating tothis employee and establishes a ‘pattern of life’ for that person, whichis dynamically updated as more information is gathered. The ‘normal’model is used as a moving benchmark, allowing the system to spotbehavior on a system that seems to fall outside of this normal patternof life, and flags this behavior as anomalous, requiring furtherinvestigation.

The threat detection system is built to deal with the fact that today'sattackers are getting stealthier and an attacker may be ‘hiding’ in asystem to ensure that they avoid raising suspicion in an end user, suchas by slowing their machine down, using normal software protocol. Anyattack process thus stops or ‘backs off’ automatically if the mouse orkeyboard is used. However, yet more sophisticated attacks try theopposite, hiding in memory under the guise of a normal process andstealing CPU cycles only when the machine is active, in an attempt todefeat a relatively-simple policing process. These sophisticatedattackers look for activity that is not directly associated with theuser's input. As an APT (Advanced Persistent Threat) attack typicallyhas very long mission windows of weeks, months or years, such processorcycles can be stolen so infrequently that they do not impact machineperformance. But, however cloaked and sophisticated the attack is, therewill always be a measurable delta, even if extremely slight, in typicalmachine behavior, between pre and post compromise. This behavioral deltacan be observed and acted on with the form of Bayesian mathematicalanalysis used by the threat detection system installed on the computer1.

The cyber defense self-learning platform uses machine-learningtechnology. The machine learning technology, using advanced mathematics,can detect previously unidentified threats, without rules, andautomatically defend networks. Note, today's attacks can be of suchseverity and speed that a human response cannot happen quickly enough.Thanks to these self-learning advances, it is now possible for a machineto uncover emerging threats and deploy appropriate, real-time responsesto fight back against the most serious cyber threats.

The cyber threat defense system builds a sophisticated ‘pattern oflife’—that understands what represents normality for every person,device, and network activity in the system being protected by the cyberthreat defense system.

The threat detection system has the ability to self-learn and detectnormality in order to spot true anomalies, allowing organizations of allsizes to understand the behavior of users and machines on their networksat both an individual and group level. Monitoring behaviors, rather thanusing predefined descriptive objects and/or signatures, means that moreattacks can be spotted ahead of time and extremely subtle indicators ofwrongdoing can be detected. Unlike traditional legacy defenses, aspecific attack type or new malware does not have to have been seenfirst before it can be detected. A behavioral defense approachmathematically models both machine and human activity behaviorally, atand after the point of compromise, in order to predict and catch today'sincreasingly sophisticated cyber-attack vectors. It is thus possible tocomputationally establish what is normal, in order to then detect whatis abnormal.

This intelligent system is capable of making value judgments andcarrying out higher value, more thoughtful tasks. Machine learningrequires complex algorithms to be devised and an overarching frameworkto interpret the results produced. However, when applied correctly theseapproaches can facilitate machines to make logical, probability-baseddecisions and undertake thoughtful tasks.

Advanced machine learning is at the forefront of the fight againstautomated and human-driven cyber-threats, overcoming the limitations ofrules and signature-based approaches:

-   -   The machine learning learns what is normal within a network—it        does not depend upon knowledge of previous attacks.    -   The machine learning thrives on the scale, complexity and        diversity of modern businesses, where every device and person is        slightly different.    -   The machine learning turns the innovation of attackers against        them—any unusual activity is visible.    -   The machine learning constantly revisits assumptions about        behavior, using probabilistic mathematics.    -   The machine learning is always up to date and not reliant on        human input. Utilizing machine learning in cyber security        technology is difficult, but when correctly implemented it is        extremely powerful. The machine learning means that previously        unidentified threats can be detected, even when their        manifestations fail to trigger any rule set or signature.        Instead, machine learning allows the system to analyze large        sets of data and learn a ‘pattern of life’ for what it sees.

Machine learning can approximate some human capabilities to machines,such as:

-   -   Thought: it uses past information and insights to form its        judgments;    -   Real time: the system processes information as it goes; and    -   Self-improving: the model's machine learning understanding is        constantly being challenged and adapted, based on new        information.

New unsupervised machine learning therefore allows computers torecognize evolving threats, without prior warning or supervision.

Unsupervised Machine Learning

Unsupervised learning works things out without pre-defined labels. Inthe case of sorting the series of different animals, the system analyzesthe information and works out the different classes of animals. Thisallows the system to handle the unexpected and embrace uncertainty. Thesystem does not always know what it is looking for, but canindependently classify data and detect compelling patterns.

The cyber threat defense system's unsupervised machine learning methodsdo not require training data with pre-defined labels. Instead, they areable to identify key patterns and trends in the data, without the needfor human input. The advantage of unsupervised learning is that itallows computers to go beyond what their programmers already know anddiscover previously unknown relationships.

The cyber threat defense system uses unique implementations ofunsupervised machine learning algorithms to analyze network data atscale, intelligently handle the unexpected, and embrace uncertainty.Instead of relying on knowledge of past threats to be able to know whatto look for, it is able to independently classify data and detectcompelling patterns that define what may be considered to be normalbehavior. Any new behaviors that deviate from those, which constitutethis notion of ‘normality,’ may indicate threat or compromise. Theimpact of the cyber threat defense system's unsupervised machinelearning on cyber security is transformative:

-   -   Threats from within, which would otherwise go undetected, can be        spotted, highlighted, contextually prioritized and isolated        using these algorithms.    -   The application of machine learning has the potential to provide        total network visibility and far greater detection levels,        ensuring that networks have an internal defense mechanism.    -   Machine learning has the capability to learn when to action        automatic responses against the most serious cyber threats,        disrupting in progress attacks before they become a crisis for        the organization.

This new mathematics not only identifies meaningful relationships withindata, but also quantifies the uncertainty associated with suchinference. By knowing and understanding this uncertainty, it becomespossible to bring together many results within a consistentframework—the basis of Bayesian probabilistic analysis. The mathematicsbehind machine learning is extremely complex and difficult to get right.Robust, dependable algorithms are developed, with a scalability thatenables their successful application to real-world environments.

Overview

In an embodiment, a closer look at the cyber threat defense system'smachine learning algorithms and approaches is as follows.

The cyber threat defense system's probabilistic approach to cybersecurity is based on a Bayesian framework. This allows it to integrate ahuge number of weak indicators of potentially anomalous network behaviorto produce a single clear measure of how likely a network device is tobe compromised. This probabilistic mathematical approach provides anability to understand important information, amid the noise of thenetwork—even when it does not know what it is looking for.

Ranking Threats

Crucially, the cyber threat defense system's approach accounts for theinevitable ambiguities that exist in data, and distinguishes between thesubtly differing levels of evidence that different pieces of data maycontain. Instead of generating the simple binary outputs ‘malicious’ or‘benign,’ the cyber threat defense system's mathematical algorithmsproduce outputs that indicate differing degrees of potential compromise.This output enables users of the system to rank different alerts in arigorous manner and prioritize those that most urgently require action,simultaneously removing the problem of numerous false positivesassociated with a rule-based approach.

At its core, the cyber threat defense system mathematicallycharacterizes what constitutes ‘normal’ behavior based on the analysisof a large number/set of different measures of a devices networkbehavior, examples include:

-   -   Server access;    -   Data access;    -   Timings of events;    -   Credential use;    -   DNS requests; and    -   other similar parameters.

Each measure of network behavior is then monitored in real time todetect anomalous behaviors.

Clustering

To be able to properly model what should be considered as normal for adevice, its behavior must be analyzed in the context of other similardevices on the network. To accomplish this, the cyber threat defensesystem leverages the power of unsupervised learning to algorithmicallyidentify naturally occurring groupings of devices, a task which isimpossible to do manually on even modestly sized networks.

In order to achieve as holistic a view of the relationships within thenetwork as possible, the cyber threat defense system simultaneouslyemploys a number of different clustering methods including matrix basedclustering, density based clustering and hierarchical clusteringtechniques. The resulting clusters are then used to inform the modelingof the normative behaviors of individual devices.

Clustering: At a glance:

-   -   Analyzes behavior in the context of other similar devices on the        network;    -   Algorithms identify naturally occurring groupings of        devices—impossible to do manually; and    -   Simultaneously runs a number of different clustering methods to        inform the models.

Network Topology

Any cyber threat detection system must also recognize that a network isfar more than the sum of its individual parts, with much of its meaningcontained in the relationships among its different entities, and thatcomplex threats can often induce subtle changes in this networkstructure. To capture such threats, the cyber threat defense systememploys several different mathematical methods in order to be able tomodel multiple facets of a networks topology.

One approach is based on iterative matrix methods that reveal importantconnectivity structures within the network. In tandem with these, thecyber threat defense system has developed innovative applications ofmodels from the field of statistical physics, which allow the modelingof a network's ‘energy landscape’ to reveal anomalous substructures thatmay be concealed within.

Network Structure

A further important challenge in modeling the behaviors of networkdevices, as well as of networks themselves, is the high-dimensionalstructure of the problem with the existence of a huge number ofpotential predictor variables. Observing packet traffic and hostactivity within an enterprise LAN, WAN and Cloud is difficult becauseboth input and output can contain many inter-related features(protocols, source and destination machines, log changes and ruletriggers, etc.). Learning a sparse and consistent structured predictivefunction is crucial to avoid the curse of over fitting.

In this context, the cyber threat defense system has employed a cuttingedge large-scale computational approach to learn sparse structure inmodels of network behavior and connectivity based on applyingL1-regulation techniques (e.g. a lasso method). This allows for thediscovery of true associations between different network components andevents that can be cast as efficiently solvable convex optimizationproblems and yield parsimonious models.

Recursive Bayesian Estimation

To combine these multiple analyses of different measures of networkbehavior to generate a single comprehensive picture of the state of eachdevice, the cyber threat defense system takes advantage of the power ofRecursive Bayesian Estimation (RBE) via an implementation of the Bayesfilter.

Using RBE, the cyber threat defense system's mathematical models areable to constantly adapt themselves, in a computationally efficientmanner, as new information becomes available to the system. Theycontinually recalculate threat levels in the light of new evidence,identifying changing attack behaviors where conventional signature-basedmethods fall down.

The cyber threat defense system's innovative approach to cyber securityhas pioneered the use of Bayesian methods for tracking changing devicebehaviors and computer network structures. The core of the cyber threatdefense system's mathematical modeling is the determination of normativebehavior, enabled by a sophisticated software platform that allows forits mathematical models to be applied to new network data in real time.The result is a system that is able to identify subtle variations inmachine events within a computer networks behavioral history that mayindicate cyber-threat or compromise.

The cyber threat defense system uses mathematical analysis and machinelearning to detect potential threats, allowing the system to stay aheadof evolving risks. The cyber threat defense system approach means thatdetection no longer depends on an archive of previous attacks. Instead,attacks can be spotted against the background understanding of whatrepresents normality within a network. No pre-definitions are needed,which allows for the best possible insight and defense against today'sthreats. On top of the detection capability, the cyber threat defensesystem can create digital antibodies automatically, as an immediateresponse to the most threatening cyber breaches. The cyber threatdefense system approach both detects and defends against cyber threat.Genuine unsupervised machine learning eliminates the dependence onsignature-based approaches to cyber security, which are not working. Thecyber threat defense system's technology can become a vital tool forsecurity teams attempting to understand the scale of their network,observe levels of activity, and detect areas of potential weakness.These no longer need to be manually sought out, but are flagged by theautomated system and ranked in terms of their significance.

Machine learning technology is the fundamental ally in the defense ofsystems from the hackers and insider threats of today, and informulating response to unknown methods of cyber-attack. It is amomentous step change in cyber security. Defense must start within.

An Example Method

The threat detection system shall now be described in further detailwith reference to a flow of the process carried out by the threatdetection system for automatic detection of cyber threats throughprobabilistic change in normal behavior through the application of anunsupervised Bayesian mathematical model to detect behavioral change incomputers and computer networks.

The core threat detection system is termed the ‘Bayesian probabilistic’.The Bayesian probabilistic is a Bayesian system of automaticallydetermining periodicity in multiple time series data and identifyingchanges across single and multiple time series data for the purpose ofanomalous behavior detection.

Human, machine or other activity is modeled by initially ingesting datafrom a number of sources at step S1 and deriving second order metrics atstep S2 from that raw data.

The raw data sources include, but are not limited to:

-   -   Raw network IP traffic captured from an IP or other network TAP        or SPAN port;    -   Machine generated log files;    -   Building access (“swipe card”) systems;    -   IP or non IP data flowing over an Industrial Control System        (ICS) distributed network;    -   Individual machine, peripheral or component power usage;    -   Telecommunication signal strength; and/or    -   Machine level performance data taken from on-host sources (CPU        usage/memory usage/disk usage/disk free space/network        usage/etc.)

From these raw sources of data, a large number of metrics can be derivedeach producing time series data for the given metric. The data arebucketed into individual time slices (for example, the number observedcould be counted per 1 second, per 10 seconds or per 60 seconds), whichcan be combined at a later stage where required to provide longer rangevalues for any multiple of the chosen internal size. For example, if theunderlying time slice chosen is 60 seconds long, and thus each metrictime series stores a single value for the metric every 60 seconds, thenany new time series data of a fixed multiple of 60 seconds (120 seconds,180 seconds, 600 seconds etc.) can be computed with no loss of accuracy.Metrics are chosen directly and fed to the Bayesian probabilistic by alower order model which reflects some unique underlying part of thedata, and which can be derived from the raw data with particular domainknowledge. The metrics that are obtained depends on the threats that thesystem is looking for. In order to provide a secure system, it is commonfor a large number of metrics relating to a wide range of potentialthreats to be obtained. Communications from components in the networkcontacting known suspect domains.

The actual metrics used are largely irrelevant to the Bayesianprobabilistic system, which is described here, but some examples areprovided below.

Metrics derived from network traffic could include data such as:

-   -   The number of bytes of data entering or leaving a networked        device per time interval.    -   File access.    -   The commonality/rarity of a communications process    -   Invalid SSL certification.    -   Failed authorization attempt.    -   Email access patterns.

In the case where TCP, UDP or other Transport Layer IP protocols areused over the IP network, and in cases where alternative Internet Layerprotocols are used (e.g. ICMP, IGMP), knowledge of the structure of theprotocol in use and basic packet header analysis can be utilized togenerate further metrics, such as:

-   -   The number of multicasts per time interval originating from a        networked device and intended to reach publicly addressable IP        ranges.    -   The number of internal link-local IP Broadcast requests        originating from a networked device.    -   The size of the packet payload data.    -   The number of individual TCP connections made by a device, or        data transferred by a device, either as a combined total across        all destinations or to any definable target network range, (e.g.        a single target machine, or a specific network range)

In the case of IP traffic, in the case where the Application Layerprotocol can be determined and analyzed, further types of time seriesmetric can be defined, for example:

-   -   The number of DNS requests a networked device generates per time        interval, again either to any definable target network range or        in total.    -   The number of SMTP, POP or IMAP logins or login failures a        machine generates per time interval.    -   The number of LDAP logins or login failures a generated.    -   Data transferred via file sharing protocols such as SMB, SMB2,        FTP, etc.    -   Logins to Microsoft Windows Active Directory, SSH or Local        Logins to Linux or Unix Like systems, or other authenticated        systems such as Kerberos.

The raw data required to obtain these metrics may be collected via apassive fiber or copper connection to the networks internal switch gear,from virtual switching implementations, from cloud based systems, orfrom communicating devices themselves. Ideally the system receives acopy of every communications packet to provide full coverage of anorganization.

For other sources, a number of domain specific time series data arederived, each chosen to reflect a distinct and identifiable facet of theunderlying source of the data, which in some way reflects the usage orbehavior of that system over time.

Many of these time series data are extremely sparse, and have the vastmajority of data points equal to 0. Examples would be employee's usingswipe cards to access a building or part of a building, or user'slogging into their workstation, authenticated by Microsoft WindowsActive Directory Server, which is typically performed a small number oftimes per day. Other time series data are much more populated, forexample the size of data moving to or from an always-on Web Server, theWeb Servers CPU utilization, or the power usage of a photocopier.

Regardless of the type of data, it is extremely common for such timeseries data, whether originally produced as the result of explicit humanbehavior or an automated computer or other system to exhibitperiodicity, and have the tendency for various patterns within the datato recur at approximately regular intervals. Furthermore, it is alsocommon for such data to have many distinct but independent regular timeperiods apparent within the time series.

At step S3, detectors carry out analysis of the second order metrics.Detectors are discrete mathematical models that implement a specificmathematical method against different sets of variables with the targetnetwork. For example, HMM may look specifically at the size andtransmission time of packets between nodes. The detectors are providedin a hierarchy that is a loosely arranged pyramid of models. Eachdetector model effectively acts as a filter and passes its output toanother model higher up the pyramid. At the top of the pyramid is theBayesian probabilistic that is the ultimate threat decision makingmodel. Lower order detectors each monitor different global attributes or‘features’ of the underlying network and or computers. These attributesconsist of value over time for all internal computational features suchas packet velocity and morphology, endpoint file system values, andTCP/IP protocol timing and events. Each detector is specialized torecord and make decisions on different environmental factors based onthe detectors own internal mathematical model such as an HMM.

While the threat detection system may be arranged to look for anypossible threat, in practice the system may keep watch for one or morespecific threats depending on the network in which the threat detectionsystem is being used. For example, the threat detection system providesa way for known features of the network such as desired compliance andHuman Resource policies to be encapsulated in explicitly definedheuristics or detectors that can trigger when in concert with set ormoving thresholds of probability abnormality coming from the probabilitydetermination output. The heuristics are constructed using complexchains of weighted logical expressions manifested as regular expressionswith atomic objects that are derived at run time from the output of datameasuring/tokenizing detectors and local contextual information. Thesechains of logical expression are then stored in and/or on onlinelibraries and parsed in real-time against output from themeasures/tokenizing detectors. An example policy could take the form of“alert me if any employee subject to HR disciplinary circumstances(contextual information) is accessing sensitive information (heuristicdefinition) in a manner that is anomalous when compared to previousbehavior (Bayesian probabilistic output)”. In other words, differentarrays of pyramids of detectors are provided for detecting particulartypes of threats.

The analysis performed by the detectors on the second order metrics thenoutputs data in a form suitable for use with the model of normalbehavior. As will be seen, the data is in a form suitable for comparingwith the model of normal behavior and for updating the model of normalbehavior.

At step S4, the threat detection system computes a threat risk parameterindicative of a likelihood of there being a threat using automatedadaptive periodicity detection mapped onto observed behavioralpattern-of-life analysis. This deduces that a threat over time existsfrom a collected set of attributes that themselves have shown deviationfrom normative collective or individual behavior. The automated adaptiveperiodicity detection uses the period of time the Bayesian probabilistichas computed to be most relevant within the observed network and/ormachines. Furthermore, the pattern of life analysis identifies how ahuman and/or machine behaves over time, i.e. when they typically startand stop work. Since these models are continually adapting themselvesautomatically, they are inherently harder to defeat than known systems.The threat risk parameter is a probability of there being a threat incertain arrangements. Alternatively, the threat risk parameter is avalue representative of there being a threat, which is compared againstone or more thresholds indicative of the likelihood of a threat.

In practice, the step of computing the threat involves comparing currentdata collected in relation to the user with the model of normal behaviorof the user and system being analyzed. The current data collectedrelates to a period in time, this could be in relation to a certaininflux of new data or a specified period of time from a number ofseconds to a number of days. In some arrangements, the system isarranged to predict the expected behavior of the system. The expectedbehavior is then compared with actual behavior in order to determinewhether there is a threat.

The system uses machine learning/AI to understand what is normal insidea company's network, and when something's not normal. The system theninvokes automatic responses to disrupt the cyber-attack until the humanteam can catch up. This could include interrupting connections,preventing the sending of malicious emails, preventing file access,preventing communications outside of the organization, etc. The approachbegins in as surgical and directed way as possible to interrupt theattack without affecting the normal behavior of say a laptop, but if theattack escalates, it may ultimately become necessary to quarantine adevice to prevent wider harm to an organization.

In order to improve the accuracy of the system, a check can be carriedout in order to compare current behavior of a user with associatedusers, i.e. users within a single office. For example, if there is anunexpectedly low level of activity from a user, this may not be due tounusual activity from the user, but could be due to a factor affectingthe office as a whole. Various other factors can be taken into accountin order to assess whether or not abnormal behavior is actuallyindicative of a threat.

Finally, at step S5 a determination is made, based on the threat riskparameter, as to whether further action need be taken regarding thethreat. This determination may be made by a human operator after beingpresented with a probability of there being a threat, or an algorithmmay make the determination, e.g. by comparing the determined probabilitywith a threshold.

In one arrangement, given the unique global input of the Bayesianprobabilistic, a form of threat visualization is provided in which theuser can view the threat landscape across all internal traffic and do sowithout needing to know how their internal network is structured orpopulated and in such a way as a ‘universal’ representation is presentedin a single pane no matter how large the network. A topology of thenetwork under scrutiny is projected automatically as a graph based ondevice communication relationships via an interactive 3D user interface.The projection is able to scale linearly to any node scale without priorseeding or skeletal definition.

The threat detection system that has been discussed above thereforeimplements a propriety form of recursive Bayesian estimation to maintaina distribution over the probability state variable. This distribution isbuilt from the complex set of low-level host, network and trafficobservations or ‘features’. These features are recorded iteratively andprocessed in real time on the platform. A plausible representation ofthe relational information among entities in dynamic systems in general,such as an enterprise network, a living cell or a social community, orindeed the entire internet, is a stochastic network, which istopological rewiring and semantically evolving over time. In manyhigh-dimensional structured I/O problems, such as the observation ofpacket traffic and host activity within a distributed digitalenterprise, where both input and output can contain tens of thousands,sometimes even millions of interrelated features (data transport,host-web-client dialogue, log change and rule trigger, etc.), learning asparse and consistent structured predictive function is challenged by alack of normal distribution. To overcome this, the threat detectionsystem consists of a data structure that decides on a rolling continuumrather than a stepwise method in which recurring time cycles such as theworking day, shift patterns and other routines are dynamically assigned.Thus providing a non-frequentist architecture for inferring and testingcausal links between explanatory variables, observations and featuresets. This permits an efficiently solvable convex optimization problemand yield parsimonious models. In such an arrangement, the threatdetection processing may be triggered by the input of new data.Alternatively, the threat detection processing may be triggered by theabsence of expected data. In some arrangements, the processing may betriggered by the presence of a particular actionable event.

The method and system are arranged to be performed by one or moreprocessing components with any portions of software stored in anexecutable format on a computer readable medium. The computer readablemedium may be non-transitory and does not include radio or other carrierwaves. The computer readable medium could be, for example, a physicalcomputer readable medium such as semiconductor or solid state memory,magnetic tape, a removable computer diskette, a random access memory(RAM), a read-only memory (ROM), a rigid magnetic disc, and an opticaldisk, such as a CD-ROM, CD-R/W or DVD.

The various methods described above may be implemented by a computerprogram product. The computer program product may include computer codearranged to instruct a computer to perform the functions of one or moreof the various methods described above. The computer program and/or thecode for performing such methods may be provided to an apparatus, suchas a computer, on a computer readable medium or computer programproduct. For the computer program product, a transitory computerreadable medium may include radio or other carrier waves.

An apparatus such as a computer may be configured in accordance withsuch code to perform one or more processes in accordance with thevarious methods discussed herein.

Web Site

The web site is configured as a browser-based tool or direct cooperatingapp tool for configuring, analyzing, and communicating with the cyberthreat defense system.

Network

A number of electronic systems and devices can communicate with eachother in a network environment. The network environment has acommunications network. The network can include one or more networksselected from an optical network, a cellular network, the Internet, aLocal Area Network (“LAN”), a Wide Area Network (“WAN”), a satellitenetwork, a 3^(rd) party ‘cloud’ environment; a fiber network, a cablenetwork, and combinations thereof. In some embodiments, thecommunications network is the Internet. There may be many servercomputing systems and many client computing systems connected to eachother via the communications network.

The communications network can connect one or more server computingsystems selected from at least a first server computing system and asecond server computing system to each other and to at least one or moreclient computing systems as well. The server computing systems can eachoptionally include organized data structures such as databases. Each ofthe one or more server computing systems can have one or more virtualserver computing systems, and multiple virtual server computing systemscan be implemented by design. Each of the one or more server computingsystems can have one or more firewalls and similar defenses to protectdata integrity.

At least one or more client computing systems for example, a mobilecomputing device (e.g., smartphone with an Android-based operatingsystem can communicate with the server(s). The client computing systemcan include, for example, the software application or the hardware-basedsystem in which may be able exchange communications with the firstelectric personal transport vehicle, and/or the second electric personaltransport vehicle. Each of the one or more client computing systems canhave one or more firewalls and similar defenses to protect dataintegrity.

A cloud provider platform may include one or more of the servercomputing systems. A cloud provider can install and operate applicationsoftware in a cloud (e.g., the network such as the Internet) and cloudusers can access the application software from one or more of the clientcomputing systems. Generally, cloud users that have a cloud-based sitein the cloud cannot solely manage a cloud infrastructure or platformwhere the application software runs. Thus, the server computing systemsand organized data structures thereof can be shared resources, whereeach cloud user is given a certain amount of dedicated use of the sharedresources. Each cloud user's cloud-based site can be given a virtualamount of dedicated space and bandwidth in the cloud. Cloud applicationscan be different from other applications in their scalability, which canbe achieved by cloning tasks onto multiple virtual machines at run-timeto meet changing work demand. Load balancers distribute the work overthe set of virtual machines. This process is transparent to the clouduser, who sees only a single access point.

Cloud-based remote access can be coded to utilize a protocol, such asHypertext Transfer Protocol (“HTTP”), to engage in a request andresponse cycle with an application on a client computing system such asa web-browser application resident on the client computing system. Thecloud-based remote access can be accessed by a smartphone, a desktopcomputer, a tablet, or any other client computing systems, anytimeand/or anywhere. The cloud-based remote access is coded to engage in 1)the request and response cycle from all web browser based applications,3) the request and response cycle from a dedicated on-line server, 4)the request and response cycle directly between a native applicationresident on a client device and the cloud-based remote access to anotherclient computing system, and 5) combinations of these.

In an embodiment, the server computing system can include a serverengine, a web page management component, a content management component,and a database management component. The server engine can perform basicprocessing and operating-system level tasks. The web page managementcomponent can handle creation and display or routing of web pages orscreens associated with receiving and providing digital content anddigital advertisements. Users (e.g., cloud users) can access one or moreof the server computing systems by means of a Uniform Resource Locator(“URL”) associated therewith. The content management component canhandle most of the functions in the embodiments described herein. Thedatabase management component can include storage and retrieval taskswith respect to the database, queries to the database, and storage ofdata.

In some embodiments, a server computing system can be configured todisplay information in a window, a web page, or the like. An applicationincluding any program modules, applications, services, processes, andother similar software executable when executed on, for example, theserver computing system, can cause the server computing system todisplay windows and user interface screens in a portion of a displayscreen space. With respect to a web page, for example, a user via abrowser on the client computing system can interact with the web page,and then supply input to the query/fields and/or service presented bythe user interface screens. The web page can be served by a web server,for example, the server computing system, on any Hypertext MarkupLanguage (“HTML”) or Wireless Access Protocol (“WAP”) enabled clientcomputing system (e.g., the client computing system 802B) or anyequivalent thereof. The client computing system can host a browserand/or a specific application to interact with the server computingsystem. Each application has a code scripted to perform the functionsthat the software component is coded to carry out such as presentingfields to take details of desired information. Algorithms, routines, andengines within, for example, the server computing system can take theinformation from the presenting fields and put that information into anappropriate storage medium such as a database (e.g., database). Acomparison wizard can be scripted to refer to a database and make use ofsuch data. The applications may be hosted on, for example, the servercomputing system and served to the specific application or browser of,for example, the client computing system. The applications then servewindows or pages that allow entry of details.

Computing Systems

A computing system can be, wholly or partially, part of one or more ofthe server or client computing devices in accordance with someembodiments. Components of the computing system can include, but are notlimited to, a processing unit having one or more processing cores, asystem memory, and a system bus that couples various system componentsincluding the system memory to the processing unit. The system bus maybe any of several types of bus structures selected from a memory bus ormemory controller, a peripheral bus, and a local bus using any of avariety of bus architectures.

The computing system typically includes a variety of computingmachine-readable media. Computing machine-readable media can be anyavailable media that can be accessed by computing system and includesboth volatile and nonvolatile media, and removable and non-removablemedia. By way of example, and not limitation, computing machine-readablemedia use includes storage of information, such as computer-readableinstructions, data structures, other executable software or other data.Computer-storage media includes, but is not limited to, RAM, ROM,EEPROM, flash memory or other memory technology, CD-ROM, digitalversatile disks (DVD) or other optical disk storage, magnetic cassettes,magnetic tape, magnetic disk storage or other magnetic storage devices,or any other tangible medium which can be used to store the desiredinformation and which can be accessed by the computing device 900.Transitory media, such as wireless channels, are not included in themachine-readable media. Communication media typically embody computerreadable instructions, data structures, other executable software, orother transport mechanism and includes any information delivery media.

The system memory includes computer storage media in the form ofvolatile and/or nonvolatile memory such as read only memory (ROM) andrandom access memory (RAM). A basic input/output system (BIOS)containing the basic routines that help to transfer information betweenelements within the computing system, such as during start-up, istypically stored in ROM. RAM typically contains data and/or softwarethat are immediately accessible to and/or presently being operated on bythe processing unit. By way of example, and not limitation, the RAM caninclude a portion of the operating system, application programs, otherexecutable software, and program data.

The drives and their associated computer storage media discussed above,provide storage of computer readable instructions, data structures,other executable software and other data for the computing system.

A user may enter commands and information into the computing systemthrough input devices such as a keyboard, touchscreen, or software orhardware input buttons, a microphone, a pointing device and/or scrollinginput component, such as a mouse, trackball or touch pad. The microphonecan cooperate with speech recognition software. These and other inputdevices are often connected to the processing unit through a user inputinterface that is coupled to the system bus, but can be connected byother interface and bus structures, such as a parallel port, game port,or a universal serial bus (USB). A display monitor or other type ofdisplay screen device is also connected to the system bus via aninterface, such as a display interface. In addition to the monitor,computing devices may also include other peripheral output devices suchas speakers, a vibrator, lights, and other output devices, which may beconnected through an output peripheral interface.

The computing system can operate in a networked environment usinglogical connections to one or more remote computers/client devices, suchas a remote computing system. The logical connections can include apersonal area network (“PAN”) (e.g., Bluetooth®), a local area network(“LAN”) (e.g., Wi-Fi), and a wide area network (“WAN”) (e.g., cellularnetwork), but may also include other networks. Such networkingenvironments are commonplace in offices, enterprise-wide computernetworks, intranets and the Internet. A browser application or directapp corresponding with a cloud platform may be resident on the computingdevice and stored in the memory.

It should be noted that the present design can be carried out on asingle computing system and/or on a distributed system in whichdifferent portions of the present design are carried out on differentparts of the distributed computing system.

Note, an application described herein includes but is not limited tosoftware applications, mobile apps, and programs that are part of anoperating system application. Some portions of this description arepresented in terms of algorithms and symbolic representations ofoperations on data bits within a computer memory. These algorithmicdescriptions and representations are the means used by those skilled inthe data processing arts to most effectively convey the substance oftheir work to others skilled in the art. An algorithm is here, andgenerally, conceived to be a self-consistent sequence of steps leadingto a desired result. The steps are those requiring physicalmanipulations of physical quantities. Usually, though not necessarily,these quantities take the form of electrical or magnetic signals capableof being stored, transferred, combined, compared, and otherwisemanipulated. It has proven convenient at times, principally for reasonsof common usage, to refer to these signals as bits, values, elements,symbols, characters, terms, numbers, or the like. These algorithms canbe written in a number of different software programming languages suchas Python, C, C+, or other similar languages. Also, an algorithm can beimplemented with lines of code in software, configured logic gates insoftware, or a combination of both. In an embodiment, the logic consistsof electronic circuits that follow the rules of Boolean Logic, softwarethat contain patterns of instructions, or any combination of both.

It should be borne in mind, however, that all of these and similar termsare to be associated with the appropriate physical quantities and aremerely convenient labels applied to these quantities. Unlessspecifically stated otherwise as apparent from the above discussions, itis appreciated that throughout the description, discussions utilizingterms such as “processing” or “computing” or “calculating” or“determining” or “displaying” or the like, refer to the action andprocesses of a computer system, or similar electronic computing device,that manipulates and transforms data represented as physical(electronic) quantities within the computer system's registers andmemories into other data similarly represented as physical quantitieswithin the computer system memories or registers, or other suchinformation storage, transmission or display devices.

Many functions performed by electronic hardware components can beduplicated by software emulation. Thus, a software program written toaccomplish those same functions can emulate the functionality of thehardware components in input-output circuitry.

While the foregoing design and embodiments thereof have been provided inconsiderable detail, it is not the intention of the applicant(s) for thedesign and embodiments provided herein to be limiting. Additionaladaptations and/or modifications are possible, and, in broader aspects,these adaptations and/or modifications are also encompassed.Accordingly, departures may be made from the foregoing design andembodiments without departing from the scope afforded by the followingclaims, which scope is only limited by the claims when appropriatelyconstrued.

What is claimed is:
 1. A method of protecting a system, including butnot limited to a network, from a cyber threat, comprising: identifying,with one or more Artificial Intelligence models trained with machinelearning on a normal behavior of the system, at least one of i) anabnormal behavior, ii) a suspicious activity, and iii) any combinationof both, from one or more entities in the system; forming one or morehypotheses on what are a possible set of cyber threats that couldinclude the identified abnormal behavior and/or suspicious activity withone or more AI models trained with machine learning on possible cyberthreats; analyzing a collection of system data, including metrics data,to support or refute each of the one or more possible cyber threathypotheses that could include the identified abnormal behavior and/orsuspicious activity data with the one or more AI models trained withmachine learning on possible cyber threats; and formatting an output ofone or more supported possible cyber threat hypotheses from the possibleset of cyber threat hypotheses into a formalized report, from a firsttemplate, that is outputted for a human user's consumption in a mediumselectable from a group consisting of 1) printable report, 2) presenteddigitally on a user interface, 3) in a machine readable format forfurther use in machine-learning reinforcement and refinement, or 4) anycombination of the three.
 2. The method of claim 1, further comprising:wherein the AI models trained with machine learning on possible cyberthreats are at least one or more supervised machine learning models, andusing both 1) the one or more supervised machine learning models trainedon agnostic examples of past history of detection of a multitude ofpossible types of cyber threat hypotheses previously analyzed by humancyber threat analysis, and 2) one or more unsupervised machine learningmodels trained to perform anomaly detection verses a normal pattern oflife to determine whether the abnormal behavior and/or suspiciousactivity is malicious or benign when the cyber threat is previouslyunknown.
 3. The method of claim 1, further comprising: initiating acollection of data to support or refute each of the one or more possiblecyber threat hypotheses that could include this abnormal behavior orsuspicious activity by the one or more AI models trained on possiblecyber threats, extracting data on each possible hypothetical threat thatwould include the abnormal behavior or suspicious activity and thenfiltering that collection of data down to relevant points of data toeither 1) support or 2) refute each particular hypothesis of what thecyber threat the suspicious activity and/or abnormal behavior relatesto, and sending the filtered down relevant points of data to either 1)support or 2) refute each particular hypothesis to one or morealgorithms used by the AI models trained with machine learning onpossible cyber threats to make a determination on a probable likelihoodof whether that particular hypothesis is supported or refuted.
 4. Themethod of claim 3, further comprising: using a plurality of scripts towalk through a step by step process of what to collect to filter down tothe relevant data points to make a decision and analyze possible cyberthreats and one or more AI models trained with machine learning on aprocess of human analyzing on possible cyber threats and the relevantdata points human analysts examine to support or rebut their analysis ofa given cyber threat hypothesis.
 5. The method of claim 1, furthercomprising: assigning either i) a probability or ii) a confidence level,of a given cyber threat hypothesis that is supported and a threat levelposed by that cyber threat hypothesis, which includes this abnormalbehavior or suspicious activity, with the one or more AI models trainedon possible cyber threats.
 6. The method of claim 5, further comprising:generating a textual write up of an incident report in the formalizedreport for a wide range of breaches of normal behavior, used by the AImodels trained with machine learning on the normal behavior of thesystem, based on analyzing previous reports with one or more modelstrained with machine learning on assessing and populating relevant datainto the incident report corresponding to each possible cyber threat. 7.The method of claim 1, further comprising: generating a threat incidentreport in the formalized report from a multitude of dynamichuman-supplied and/or machine created templates corresponding todifferent types of cyber threats, each template, including the firsttemplate, corresponding to different types of cyber threats that vary informat, style, and standard fields in the multitude of templates,populating a given template with relevant data, graphs, or otherinformation as appropriate in various specified fields, along with aranking of a likelihood of whether that hypothesis cyber threat issupported and its threat severity level for each of the supported cyberthreat hypotheses, and then outputting the formatted threat incidentreport with the ranking of each supported cyber threat hypothesis, whichis presented digitally on the user interface and/or printed as theprintable report.
 8. The method of claim 1, further comprising:utilizing repetitive feedback, as time goes on, for the AI modelstrained with machine learning on possible cyber threats via reviewing asubsequent resulting analysis of the supported possible cyber threathypotheses and supply that information to the training of the AI modelstrained with machine learning on possible cyber threats in order toreinforce the model's finding were correct or inaccurate.
 9. The methodof claim 1, further comprising: ranking supported candidate cyber threathypotheses by combination of a likelihood that this candidate cyberthreat hypothesis is supported as well as severity threat level of thisincident type, where these factors are combined to create a totalordering possible cyber threat hypotheses presented in the formalizedreport on the user interface, where a filtering out of refuted cyberthreat hypotheses and putting higher supported and more severe threatlevel possible cyber threat hypotheses higher in the total ordering ofpossible cyber threat hypotheses allows cyber personnel to better focuson interesting cyber threats that could include the identified abnormalbehavior and/or suspicious activity data.
 10. A non-transitory computerreadable medium comprising computer readable code operable, whenexecuted by one or more processing apparatuses in the computer system toinstruct a computing device to perform the method of claim
 1. 11. Aapparatus to protect a system, including but not limited to a network,from a cyber threat, comprising: a trigger module configured toidentify, with one or more Artificial Intelligence models trained withmachine learning on a normal behavior of the system, at least one of i)an abnormal behavior, ii) a suspicious activity, and iii) anycombination of both, from one or more entities in the system; ananalyzer module configured to form one or more hypotheses on what are apossible set of cyber threats that could include the identified abnormalbehavior and/or suspicious activity from the trigger module with one ormore AI models trained with machine learning on possible cyber threats;where the analyzer module is further configured to analyze a collectionof system data, including metrics data, to support or refute each of theone or more possible cyber threat hypotheses that could include theidentified abnormal behavior and/or suspicious activity data with theone or more AI models trained with machine learning on possible cyberthreats, where the analyzer module generates one or more supportedpossible cyber threat hypotheses from the possible set of cyber threathypotheses; and a formatting module configured to format, present a rankfor, and output one or more supported possible cyber threat hypothesesfrom the analyzer module into a formalized report, from a firsttemplate, that is outputted for a human user's consumption in a mediumof any of 1) printable report, 2) presented digitally on a userinterface, 3) in a machine readable format for further use inmachine-learning reinforcement and refinement, or 4) any combination ofthe three.
 12. The apparatus of claim 11, further comprising: whereinthe AI models trained with machine learning on possible cyber threatsare at least one or more supervised machine learning models, and whereinthe analyzer module is configured to use both 1) the one or moresupervised machine learning models trained on agnostic examples of pasthistory of detection of a multitude of possible types of cyber threathypotheses previously analyzed by human cyber threat analysis, and 2)one or more unsupervised machine learning models trained to performanomaly detection verses a normal pattern of life to determine whetherthe abnormal behavior and/or suspicious activity is malicious or benignwhen the cyber threat is previously unknown.
 13. The apparatus of claim11, further comprising: a gatherer module configured to initiate acollection of data to support or refute each of the one or more possiblecyber threat hypotheses that could include this abnormal behavior orsuspicious activity by the one or more AI models trained on possiblecyber threats, wherein the gatherer module is further configured toextract data, from a request from the analyzer module, on each possiblehypothetical threat that would include the abnormal behavior orsuspicious activity and then filtering that collection of data down torelevant points of data to either 1) support or 2) refute eachparticular hypothesis of what the cyber threat, the suspicious activity,and/or abnormal behavior relates to, and send the filtered down relevantpoints of data to the analyzer module to either 1) support or 2) refuteeach particular hypothesis to one or more algorithms used by the AImodels trained with machine learning on possible cyber threats to make adetermination on a probable likelihood of whether that particularhypothesis is supported or refuted.
 14. The apparatus of claim 13,wherein the gatherer module is further configured to use a plurality ofscripts to walk through a step by step process of what to collect tofilter down to the relevant data points to assist the analyzer module inmaking a decision and analyzing possible cyber threats, and supplyingfurther data requested by the analyzer module due to one or more AImodels trained with machine learning on a process of human analyzing onpossible cyber threats and the relevant data points human analystsexamine to support or rebut their analysis of a given cyber threathypothesis.
 15. The apparatus of claim 11, further comprising: anassessment module configured to assign a probability of a given cyberthreat hypothesis that is supported and a threat level posed by thatcyber threat hypothesis, which includes this abnormal behavior orsuspicious activity, with the one or more AI models trained on possiblecyber threats.
 16. The apparatus of claim 15, further comprising:wherein the formatting module is further configured to generate atextual write up of an incident report in the formalized report for awide range of breaches of normal behavior, used by the AI models trainedwith machine learning on the normal behavior of the system, based onanalyzing previous reports with one or more models trained with machinelearning on assessing and populating relevant data into the incidentreport corresponding to each possible cyber threat.
 17. The apparatus ofclaim 11, further comprising: wherein the formatting module is furtherconfigured to generate a threat incident report in the formalized reportfrom a multitude of a dynamic human-supplied and/or machine createdtemplates corresponding to different types of cyber threats, eachtemplate, including the first template, corresponding to different typesof cyber threats that vary in format, style, and standard fields in themultitude of templates, wherein the formatting module is furtherconfigured to populate a given template with relevant data, graphs, orother information as appropriate in various specified fields, along witha ranking of a likelihood of whether that hypothesis cyber threat issupported and its threat severity level for each of the supported cyberthreat hypotheses, and then output the formatted threat incident reportwith the ranking of each supported cyber threat hypothesis, which ispresented digitally on the user interface and/or printed as theprintable report.
 18. The apparatus of claim 11, further comprising:wherein the analyzer module is further configured to utilize repetitivefeedback, as time goes on, for the AI models trained with machinelearning on possible cyber threats via reviewing a subsequent resultinganalysis of the supported possible cyber threat hypotheses and supplythat information to the training of the AI models trained with machinelearning on possible cyber threats in order to reinforce the model'sfinding as correct or inaccurate.
 19. The apparatus of claim 11, furthercomprising: wherein the analyzer module is further configured to ranksupported candidate cyber threat hypotheses by combination of alikelihood that this candidate cyber threat hypothesis is supported aswell as severity threat level of this incident type, where these factorsare combined to create a total ordering possible cyber threat hypothesespresented in the formalized report on the user interface, where afiltering out of refuted cyber threat hypotheses and putting highersupported and more severe threat level possible cyber threat hypotheseshigher in the total ordering of possible cyber threat hypotheses allowscyber personnel to better focus on interesting cyber threats that couldinclude the identified abnormal behavior, specific threat details,and/or suspicious activity data.
 20. The apparatus of claim 11, furthercomprising: wherein the trigger module, analyzer module and formattingmodule cooperate to improve the analysis and formalized reportgeneration with less repetition to consume CPU cycles with greaterefficiency than humans repetitively going through these steps andre-duplicating steps to filter and rank the one or more supportedpossible cyber threat hypotheses from the possible set of cyber threathypotheses.